FortiGate Generic Admin Account Persistence

Mehulkumar Savajani@Msavajani

•updated Jan 23, 2026•6•1•151

This rule detects the creation of a local administrative account on a FortiGate device with a generic name commonly used by threat actors for persistence following an initial compromise. The rule specifically looks for log events indicating the addition of a new system administrator account with names like 'secadmin', 'itadmin', 'support', 'backup', 'remoteadmin', or 'audit'.